Enforce roles on admin endpoints and return real status codes

- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
  database errors no longer leak to the client

app/setting/api/engine/document_types.php

@@ -38,10 +38,16 @@ try {
             break;
 
         default:
+            http_response_code(400);
             $answer['message'] = 'Unknown action.';
     }
+} catch (PDOException $e) {
+    error_log('[' . basename(__FILE__) . '] ' . $e->getMessage());
+    $answer['message'] = 'Database error, please try again.';
+    http_response_code(500);
 } catch (Exception $e) {
     $answer['message'] = $e->getMessage();
+    http_response_code(400);
 }
 
 exit(json_encode($answer));

app/setting/api/engine/gl_maintenance.php

@@ -34,6 +34,7 @@ try {
     if ($action === 'rebuild_period') {
         $period = $data['period'] ?? '';
         if (!preg_match('/^\d{4}-\d{2}$/', $period)) {
+            http_response_code(400);
             $answer['message'] = 'Invalid period.';
             exit(json_encode($answer));
         }

app/setting/api/engine/retrieve_smtp.php

@@ -3,13 +3,17 @@
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/SmtpManager.php';
 
+    // Admin data: owners and admins only; staff and viewers never see it.
+    require_role($user_role, ['owner', 'admin']);
+
     try {
         $smtp = new SmtpManager($pdo1, $company_id, $method, $pinkey, $iv);
         $answer['success'] = 1;
         $answer['output']  = $smtp->get();
 
     } catch (Exception $e) {
-        $answer['message'] = $e->getMessage();
+        error_log('[retrieve_smtp] ' . $e->getMessage());
+        $answer['message'] = 'Could not load SMTP settings.';
         http_response_code(500);
     }
 

app/setting/api/engine/retrieve_users.php

@@ -3,6 +3,9 @@
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UserManager.php';
 
+    // Admin data: owners and admins only; staff and viewers never see it.
+    require_role($user_role, ['owner', 'admin']);
+
     $um = new UserManager($pdo1, $company_id, $user_id);
 
     $answer['success'] = 1;

app/setting/api/engine/search_users.php

@@ -3,6 +3,9 @@
     require_once '../../../assets/utils/db_auth.php';
     require_once '../../../assets/utils/classes/UserManager.php';
 
+    // Admin data: owners and admins only; staff and viewers never see it.
+    require_role($user_role, ['owner', 'admin']);
+
     $keyword = trim($data['keyword'] ?? '');
     $um      = new UserManager($pdo1, $company_id, $user_id);
 

app/setting/api/engine/stock_maintenance.php

@@ -36,6 +36,7 @@ try {
     if ($action === 'get_periods') {
         $warehouse_id = (int)($data['warehouse_id'] ?? 0);
         if (!$warehouse_id) {
+            http_response_code(400);
             $answer['message'] = 'warehouse_id is required.';
             exit(json_encode($answer));
         }
@@ -48,6 +49,7 @@ try {
         $warehouse_id = (int)($data['warehouse_id'] ?? 0);
         $period       = $data['period'] ?? '';
         if (!$warehouse_id || !preg_match('/^\d{4}-\d{2}$/', $period)) {
+            http_response_code(400);
             $answer['message'] = 'Valid warehouse_id and period (YYYY-MM) are required.';
             exit(json_encode($answer));
         }